diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index de91d23..0000000
--- a/.gitmodules
+++ /dev/null
@@ -1,3 +0,0 @@
-[submodule "stage-0"]
-	path = stage-0
-	url = https://github.com/ublue-os/aurora
diff --git a/Containerfile b/Containerfile
index 04f82c1..89a91a8 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,9 +1,9 @@
-# Stage 1 of the build. BASE_IMAGE is stage 0: our Aurora fork, built from the
-# stage-0/ submodule by `task build-base` into root's containers-storage. Its
-# pin is the submodule commit. Pass e.g.
+# Built on our Aurora fork (quine-global-labs/aurora), which its own workflow
+# builds and publishes to this forge's registry. Pass e.g.
 # --build-arg BASE_IMAGE=ghcr.io/ublue-os/aurora:stable to build on stock
-# upstream Aurora instead.
-ARG BASE_IMAGE=localhost/aurora:stable
+# upstream Aurora instead, or localhost/aurora:stable for a local build of
+# the fork.
+ARG BASE_IMAGE=forge.quinefoundation.com/quine-global-labs/aurora:stable
 
 # --- Builds the out-of-tree snd-hda-codec-cs8409 module (iMac19,2 mic fix). ---
 # See docs/imac19-2-mic-fix.md and patches/snd-hda-codec-cs8409/ for the full
diff --git a/README.md b/README.md
index 7acfd9c..e0a9336 100644
--- a/README.md
+++ b/README.md
@@ -4,35 +4,33 @@ Quine distro of Linux based on uBlue Aurora
 
 ## Building
 
-The image is built in two stages:
+The image is built in two repos:
 
-- **Stage 0: `stage-0/`**, a git submodule holding our fork of
-  [Aurora](https://github.com/ublue-os/aurora). It's built with Aurora's own
-  `just build` into `localhost/aurora:stable`. Changes that have to happen
-  *inside* Aurora's build (its package set, build scripts, the Kinoite base
-  it starts from) go here, as commits on the fork; bump the submodule to ship
-  them. Needs a Linux host with buildah, cpp, just (>= 1.46), skopeo, jq, yq
-  and cosign.
-- **Stage 1: `Containerfile`**, which builds the quine-linux bootc image on
-  top of stage 0, layering in everything under `overlay/`, plus a
+- **[`quine-global-labs/aurora`](https://forge.quinefoundation.com/quine-global-labs/aurora)**,
+  our fork of [Aurora](https://github.com/ublue-os/aurora). Its workflow
+  builds it with Aurora's own `just build` and publishes it as
+  `forge.quinefoundation.com/quine-global-labs/aurora:stable`. Changes that
+  have to happen *inside* Aurora's build (its package set, build scripts,
+  the Kinoite base it starts from) go there, as commits on the fork.
+- **This repo's `Containerfile`**, which builds the quine-linux bootc image
+  on top of that, layering in everything under `overlay/`, plus a
   `kmod-builder` stage that compiles the CS8409 mic-fix kernel module (see
   [Hardware-specific patches](#hardware-specific-patches) below). Anything a
-  `RUN` step on top of Aurora can do belongs here, not in stage 0.
+  `RUN` step on top of Aurora can do belongs here, not in the fork. Its
+  workflow publishes `forge.quinefoundation.com/quine-global-labs/quine-linux`
+  and the installer ISO (to MinIO).
 
-Clone with `git clone --recurse-submodules`, or run
-`git submodule update --init` in an existing checkout.
+Both images are private: `sudo podman login forge.quinefoundation.com`
+(with a token that can read packages) before building locally.
 
 [`Taskfile.yml`](Taskfile.yml) (requires [`task`](https://taskfile.dev)) is
 the supported way to drive all of this — run `task` with no arguments to
 list what's available. Notably:
 
-- `task build-base` — builds stage 0. It's skipped when `stage-0/` is
-  unchanged and the image exists. Run `task build-base --force` to rebuild
-  anyway, e.g. to pick up upstream kernel and package updates, which Aurora's
-  build resolves at build time.
-- `task build-image` — builds stage 0 if needed, then stage 1. To skip stage 0
-  and build on stock upstream Aurora (the only option on macOS), pass
-  `BASE_IMAGE=ghcr.io/ublue-os/aurora:stable`. Builds locally, as root, with podman, or
+- `task build-image` — builds the image on our published Aurora. To build
+  on stock upstream Aurora instead, pass
+  `BASE_IMAGE=ghcr.io/ublue-os/aurora:stable`; on a local build of the fork,
+  `BASE_IMAGE=localhost/aurora:stable`. Builds locally, as root, with podman, or
   docker if podman isn't installed (force either with
   `CONTAINER_RUNTIME=docker|podman`). Every task below works with either;
   under docker, images are copied via skopeo into a
@@ -56,10 +54,16 @@ list what's available. Notably:
 Equivalently, by hand:
 
 ```sh
-(cd stage-0 && sudo just build --image aurora --tag stable --flavor main)
 sudo podman build -t quine-linux -f Containerfile .
 ```
 
+To build the Aurora fork yourself (Linux, with buildah, cpp, just >= 1.46,
+skopeo, jq, yq and cosign), in a clone of `quine-global-labs/aurora`:
+
+```sh
+sudo just build --image aurora --tag stable --flavor main   # -> localhost/aurora:stable
+```
+
 An ISO can then be generated from the built image with `bootc-image-builder`
 (`ghcr.io/osbuild/bootc-image-builder`; the project now lives in
 [osbuild/image-builder](https://github.com/osbuild/image-builder), and the old
diff --git a/Taskfile.yml b/Taskfile.yml
index 6baaa61..e1c4c76 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -3,16 +3,12 @@ version: '3'
 vars:
   IMAGE: quine-linux
   INSTALLER_IMAGE: quine-installer
-  # Stage 0: our Aurora fork (the stage-0/ submodule), built with its own
-  # Justfile. AURORA_TAG picks the stream (stable/latest/testing) and is also
-  # the local tag the image gets.
-  AURORA_TAG: stable
-  STAGE0_IMAGE: localhost/aurora:{{.AURORA_TAG}}
-  # What stage 1 (Containerfile) builds FROM. Defaults to stage 0; override to
-  # skip stage 0 and build on a prebuilt image, e.g.
-  # `task build-image BASE_IMAGE=ghcr.io/ublue-os/aurora:stable` (the only
-  # option on macOS, where stage 0's buildah build can't run).
-  BASE_IMAGE: '{{.STAGE0_IMAGE}}'
+  # What the Containerfile builds FROM: our Aurora fork
+  # (quine-global-labs/aurora), built and published by that repo's workflow.
+  # It's private: `podman login forge.quinefoundation.com` first. Override
+  # with a local build of the fork (BASE_IMAGE=localhost/aurora:stable, see
+  # README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
+  BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
   OUTPUT_DIR: '{{.ROOT_DIR}}/output'
   # Root is needed for the container builds and bootc; skip {{.SUDO}} when already
   # root (e.g. on a CI runner, which may not have {{.SUDO}} at all).
@@ -44,57 +40,13 @@ tasks:
       - task --list
     silent: true
 
-  build-base:
-    desc: >-
-      Stage 0: build our Aurora fork from the stage-0/ submodule with its own
-      `just build`, as root, into {{.STAGE0_IMAGE}}. Needs a Linux host with
-      buildah, cpp, just (>= 1.46), skopeo, jq, yq and cosign. Skipped when
-      stage-0/ is unchanged and the image exists; use --force to rebuild
-      anyway (e.g. to pick up upstream kernel and package updates, which
-      Aurora's build resolves at build time).
-    preconditions:
-      - sh: '[ "$(uname -s)" = Linux ]'
-        msg: >-
-          Stage 0 (Aurora's own buildah build) only runs on Linux. To build
-          on stock upstream Aurora instead, pass
-          BASE_IMAGE=ghcr.io/ublue-os/aurora:{{.AURORA_TAG}}.
-      - sh: 'for t in buildah cpp just skopeo jq yq cosign; do command -v "$t" >/dev/null || { echo "missing: $t"; exit 1; }; done'
-        msg: 'Stage 0 needs buildah, cpp, just (>= 1.46), skopeo, jq, yq and cosign on PATH.'
-    dir: stage-0
-    cmds:
-      # sudo resets PATH (just/yq/cosign often live in ~/.local/bin or brew),
-      # and git refuses to read a repo owned by another user unless told it's
-      # safe; Aurora's Justfile runs `git status` / `git rev-parse` here.
-      # Aurora reads its own past tags from ghcr.io/$GITHUB_REPOSITORY_OWNER,
-      # and hands $GITHUB_TOKEN to GitHub's API. On Forgejo Actions those are
-      # this org and a Forgejo token, so: always ublue-os, and the token only
-      # when the job runs on GitHub.
-      - >-
-        {{.SUDO}} env
-        $([ "${GITHUB_SERVER_URL:-https://github.com}" = https://github.com ] || echo -u GITHUB_TOKEN)
-        "PATH=$PATH" GITHUB_REPOSITORY_OWNER=ublue-os
-        GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
-        $([ "${GITHUB_SERVER_URL:-https://github.com}" = https://github.com ] && [ -n "${GITHUB_TOKEN:-}" ] && echo "GITHUB_TOKEN=$GITHUB_TOKEN")
-        just build --image aurora --tag {{.AURORA_TAG}} --flavor main
-      # buildah builds into root's containers-storage; docker needs it copied
-      # into its daemon for stage 1 to build FROM it.
-      - cmd: '{{.SUDO}} skopeo copy containers-storage:{{.STAGE0_IMAGE}} docker-daemon:{{.STAGE0_IMAGE}}'
-        if: '[ "{{.CONTAINER_RUNTIME}}" != podman ]'
-    # Relative to dir (stage-0/): the fork's whole checked-out tree.
-    sources:
-      - '**/*'
-    status:
-      - '{{.SUDO}} {{.CONTAINER_RUNTIME}} image inspect {{.STAGE0_IMAGE}} >/dev/null 2>&1'
-
   build-image:
     desc: >-
-      Stage 1: build the quine-linux bootc container image on top of
-      BASE_IMAGE (stage 0 by default, built first if needed), as root
+      Build the quine-linux bootc container image on top of BASE_IMAGE
+      (our Aurora build from the forge's registry by default), as root
       (under podman this lands in root's containers-storage, which bootc and
       bootc-image-builder read; under docker, the ISO tasks copy it over).
     cmds:
-      - task: build-base
-        if: '[ "{{.BASE_IMAGE}}" = "{{.STAGE0_IMAGE}}" ]'
       - >-
         {{.SUDO}} {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}}
         --build-arg BASE_IMAGE={{.BASE_IMAGE}}
@@ -103,7 +55,6 @@ tasks:
       - Containerfile
       - overlay/**/*
       - patches/**/*
-      - stage-0/**/*
 
   build-iso:
     desc: >-
diff --git a/stage-0 b/stage-0
deleted file mode 160000
index 6f5aa60..0000000
--- a/stage-0
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 6f5aa60aa5584f847a58953c96b047a8fc2d26c4